Mozilla Firefox CVE-2026-100815

Exploitation requires the victim to load attacker-controlled web content in Firefox that exercises the CSS Parsing and Computation code path (UI:R in the vector), so it is not a zero-click server-side flaw. No authentication is required (PR:N) and no non-default configuration is needed - default Firefox rendering of a malicious page is sufficient. Limiting factors: the user must actually visit or render the malicious content, exploitation must win a use-after-free race and defeat browser memory hardening, and S:U indicates impact is confined to the content process unless chained with a separate sandbox-escape bug. Affected versions are Firefox before 157 and Firefox ESR before 153.4.

This is a memory-corruption vulnerability with genuine RCE-class potential, but it sits in the 'high-CVSS, moderate real-world-priority' band rather than an emergency-patch category. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity, unauthenticated use-after-free requiring only that a victim view attacker-controlled content - the standard browser drive-by profile. The full C:H/I:H/A:H impact reflects that a UAF in the CSS parsing/computation engine can corrupt memory and plausibly lead to arbitrary code execution within the content process (S:U indicates no confirmed sandbox escape, so exploitation would still be confined to the content sandbox absent a chained escape). Countervailing signals lower the urgency: there is NO EPSS score provided, this CVE is NOT in CISA KEV, and NO public exploit code is referenced. Mozilla self-reported the flaw (bugzilla 2068404) with no indication of in-the-wild use, consistent with proactively-found fuzzing/audit bugs shipped in a coordinated batch (MFSA2026-97/100). Modern Firefox exploitation additionally requires defeating hardening (ASLR, sandbox), raising practical difficulty above what AC:L alone suggests. Net: a real bug worth patching promptly given Firefox's ubiquity, but no evidence of active or imminent mass exploitation. The 8.8 rating is agreed and internally consistent.

An attacker hosts a web page containing crafted CSS that triggers a use-after-free in Firefox's CSS parsing and computation engine when the victim navigates to it (or loads it via a malicious ad/iframe). By grooming the heap so the freed object is reallocated under attacker control, the flaw can be steered toward memory disclosure or code execution inside the content process. No public proof-of-concept is referenced at the time of analysis.